From 4741e99cf7693dfa717b70f9ca31bd994c343bed Mon Sep 17 00:00:00 2001 From: Todd Baert Date: Fri, 24 Jul 2026 12:07:36 -0400 Subject: [PATCH 1/2] chore: minor security hardening Signed-off-by: Todd Baert --- tools/specification_parser/lint_json_output.py | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/tools/specification_parser/lint_json_output.py b/tools/specification_parser/lint_json_output.py index c3099fb1..d3c04d5e 100644 --- a/tools/specification_parser/lint_json_output.py +++ b/tools/specification_parser/lint_json_output.py @@ -1,10 +1,21 @@ -from os.path import curdir, abspath, join, splitext +from os.path import curdir, abspath, join, splitext, commonpath from os import walk import json import sys +def _safe_path(f): + # reject paths that escape the current working directory + base = abspath(curdir) + target = abspath(f) + if commonpath([base, target]) != base: + print(f"Refusing to read path outside {base}: {f}", file=sys.stderr) + sys.exit(1) + return target + + def main(f): + f = _safe_path(f) errors = 0 with open(f) as jsonfile: spec = json.load(jsonfile) From d144658d6a1d5ed1e10a4b2b141c4726f362d4b6 Mon Sep 17 00:00:00 2001 From: Todd Baert Date: Fri, 24 Jul 2026 12:14:17 -0400 Subject: [PATCH 2/2] fixup: resolve symlinks in path validation Signed-off-by: Todd Baert --- tools/specification_parser/lint_json_output.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tools/specification_parser/lint_json_output.py b/tools/specification_parser/lint_json_output.py index d3c04d5e..d67dc315 100644 --- a/tools/specification_parser/lint_json_output.py +++ b/tools/specification_parser/lint_json_output.py @@ -1,13 +1,13 @@ -from os.path import curdir, abspath, join, splitext, commonpath +from os.path import curdir, abspath, realpath, join, splitext, commonpath from os import walk import json import sys def _safe_path(f): - # reject paths that escape the current working directory - base = abspath(curdir) - target = abspath(f) + # resolve symlinks and reject paths that escape the current working directory + base = realpath(curdir) + target = realpath(f) if commonpath([base, target]) != base: print(f"Refusing to read path outside {base}: {f}", file=sys.stderr) sys.exit(1)